The container root filesystem must be mounted as read-only.

Any changes to a container must be made by rebuilding the image and redeploying the new container image. Once a container is running, changes to the root filesystem should not be needed, thus preserving the immutable nature of the container. Any attempts to change the root filesystem are usually malicious in nature and can be prevented by making the root filesystem read-only.

Review the container platform configuration to determine that the root filesystem is mounted as read-only.

If the container platform does not enforce such access restrictions, this is a finding.

Review and remove nonsystem containers previously created with read-write permissions. Configure the container platform to force the root filesystem to be mounted as read-only.